libcurl keeps a pool of its last few connections around after use to
fascilitate easy, conventient and completely transparent connection re-use for
applications.

When doing HTTP requests NTLM authenticated, the entire connnection becomes
authenticated and not just the specific HTTP request which is otherwise how
HTTP works. This makes NTLM special and a subject for special treatment in the
code. With NTLM, once the connection is authenticated, no further
authentication is necessary until the connection gets closed.

libcurl's connection re-use logic will select an existing connection for
re-use when asked to do a request, and when asked to use NTLM libcurl have to
pick a connection with matching credentials only.

If a connection was first setup and used for an NTLM HTTP request with a
specific set of credentials, that same connection could later wrongly get
re-used in a subsequent HTTP request that was made to the same host - but
without having any credentials set! Since an NTLM connection was already
authenticated due to how NTLM works, the subsequent request could then get
sent over the wrong connection appearing as the initial user.

We are not aware of any exploits of this flaw.

Acknowledgements:

Red Hat would like to thank Daniel Stenberg (curl upstream) for reporting this issue. Upstream acknowledges Paras Sethia as the original reporter.